Figure REF  outlines our approach for finding copy/paste adversaries.
We attack a ResNet18 [1]} trained on ImageNet [2]}.
For all experiments, we report the mean proportion of the time that a patched image was classified as the target class minus the proportion of the time an unpatched one was.
Additional details can be found in Appendix REF .
